Systems and methods for deidentifying entries in a data source

• US 20020169793A1
• Filed: 04/10/2002
• Published: 11/14/2002
• Est. Priority Date: 04/10/2001
• Status: Active Grant

• Current Assignee: Sweeney Design Labs LLC
• Original Assignee: Sweeney Design Labs LLC
• Inventors: Sweeney, Latanya
• Granted Patent: US 7,269,578 B2
• Time in Patent Office: Days
• US Class Current: 707/204
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

Systems and methods for deidentifying, or anonymizing, entries in an input data source are presented. According to one embodiment, the system includes a deidentification module for modifying entries in a version of the input data source to yield an output data source such that the entries of the output data source match a specified anonymity requirement. According to one embodiment, the resulting output data source may match the specified anonymity requirement with respect to a recipient profile that is input to the system. The deidentification module may further modify the entries in the version of the input data source such that the entries in the output data source are minimally distorted given the specified anonymity requirement.

Claims

1. A system for deidentifying entries in an input data source, comprising:

a deidentification module for modifying entries in a version of the input data source to yield an output data source such that the entries of the output data source match a specified anonymity requirement.

2. The system of claim 1, wherein the deidentification module is further for:

receiving a recipient profile; and

modifying entries in the version of the input data such that entries of the output data source match the specified anonymity requirement with respect to the recipient profile.

3. The system of claim 2, wherein the recipient profile identifies a likelihood that entries in the output data source will be used for linking with another data source.

4. The system of claim 1, wherein the deidentification module is for modifying entries in the version of the input data source by at least one of generalizing, suppressing and replacing entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement.

5. The system of claim 1, wherein the version of the input data source includes a plurality of attributes and a plurality of tuples, and wherein the deidentification module is for modifying entries in the version of the input data source by:

determining whether each attribute in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replacing entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization.

6. The system of claim 5, wherein the deidentification module is further for replacing entries in each attribute with a replacement value determined according to a strong one-way hashing algorithm when it is determined that the attribute requires an equivalent class substitution.

7. The system of claim 5, wherein the deidentification module is further for replacing entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization by iteratively computing increasingly less specific values for each attribute until the specified anonymity requirement is obtained.

8. The system of claim 7, wherein the deidentification module is further for iteratively computing increasingly less specific values for each attribute until the specified anonymity requirement is obtained by iteratively computing less specific values for each attribute until there exists a number of tuples corresponding to the specified anonymity requirement having the same values across a group of attributes.

9. The system of claim 1, wherein the deidentification module is for modifying entries in the version of the input data source such that the entries in the output data source are minimally distorted.

10. A computer readable medium, having stored thereon instructions, which when executed by a processor, cause the processor to:

read a specified anonymity requirement; and

modify entries in a version of an input data source to yield an output data source having entries that match the specified anonymity requirement.

11. The computer readable medium of claim 10, having further stored thereon instructions, which when executed by the processor, cause the processor to:

read a specified recipient profile; and

modify entries in the version of the input data source to match the specified anonymity requirement with respect to the recipient profile.

12. The computer readable medium of claim 11, wherein the recipient profile identifies a likelihood that entries in the output data source will be used for linking with another data source.

13. The computer readable medium of claim 10, having further stored thereon instructions, which when executed by the processor, cause the processor to modify entries in the version of the input data source by at least one of generalizing, suppressing and replacing entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement.

14. The computer readable medium of claim 10, wherein the version of the input data source includes a plurality of attributes and a plurality of tuples, and having further stored thereon instructions, which when executed by the processor, cause the processor to:

determine whether each attribute in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replace entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization.

15. The computer readable medium of claim 14, having further stored thereon instructions, which when executed by the processor, cause the processor to:

replace entries in each attribute with a replacement value determined according to a strong one-way hashing algorithm when it is determined that the attribute requires an equivalent class substitution.

16. The computer readable medium of claim 14, having further stored thereon instructions, which when executed by the processor, cause the processor to:

replace entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization by iteratively computing increasingly less specific values for each attribute until the specified anonymity requirement is obtained.

17. The computer readable medium of claim 16, having further stored thereon instructions, which when executed by the processor, cause the processor to:

iteratively compute increasingly less specific values for each attribute until the specified anonymity requirement is obtained by iteratively computing less specific values for each attribute until there exists a number of tuples corresponding to the specified anonymity requirement having the same values across a group of attributes.

18. The computer readable medium of claim 10, having further stored thereon instructions, which when executed by the processor, cause the processor to modify the entries in the version of the input data source such that the entries in the output data source are minimally distorted.

20. The method of claim 19, further comprising receiving a specified recipient profile, and wherein modifying entries includes modifying entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement with respect to the recipient profile.

21. The method of claim 20, wherein the recipient profile identifies a likelihood that entries in the output data source will be used for linking with another data source.

22. The method of claim 19, wherein modifying entries in the version of the input data source includes at least one of generalizing, suppressing and replacing entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement.

23. The method of claim 19, wherein the version of the input data source includes a plurality of attributes and a plurality of tuples, and wherein modifying entries in the input data source includes:

determining whether each attribute in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replacing entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization.

24. The method of claim 23, wherein modifying entries in the version of the input data source farther includes replacing entries in each attribute with a replacement value determined according to a strong one-way hashing algorithm when it is determined that the attribute requires an equivalent class substitution.

25. The method of claim 23, wherein replacing entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization includes iteratively computing increasingly less specific values for each attribute until the specified anonymity requirement is obtained.

26. The method of claim 25, wherein iteratively computing increasingly less specific values for each attribute until the specified anonymity requirement is obtained includes iteratively computing less specific values for each attribute until there exists a number of tuples corresponding to the specified anonymity requirement having the same values across a group of attributes.

27. The method of claim 19, wherein modifying entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement with respect to the recipient profile includes modifying entries in the version of the input data source such that the entries in the output data source are minimally distorted.

29. The system of claim 28, wherein the means for modifying further include means for modifying entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement with respect to a recipient profile.

30. The system of claim 29, wherein the recipient profile identifies a likelihood that entries in the output data source will be used for linking with another data source.

31. The system of claim 28, wherein the means for modifying entries in the version of the input data source includes means for at least one of generalizing, suppressing and replacing entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement.

32. The system of claim 28, wherein the version of the input data source includes a plurality of attributes and a plurality of tuples, and wherein the means for modifying entries in the input data source is further for:

determining whether each attribute in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replacing entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization.

33. The system of claim 32, wherein the means for modifying entries is further for replacing entries in each attribute with a replacement value determined according to a strong one-way hashing algorithm when it is determined that the attribute requires an equivalent class substitution.

34. The system of claim 32, wherein the means for modifying is farther for replacing entries in each attribute with a replacement value determined according to a generalization hierarchy when it is determined that the attribute requires a generalization by iteratively computing increasingly less specific values for each attribute until the specified anonymity requirement is obtained.

35. The system of claim 34, wherein the means for modifying is further for iteratively computing increasingly less specific values for each attribute until the specified anonymity requirement is obtained by iteratively computing less specific values for each attribute until there exists a number of tuples corresponding to the specified anonymity requirement having the same values across;

a group of attributes.

36. The system of claim 28, wherein the means for modifying is further for modifying entries in the version of the input data source such that the entries in the output data source are minimally distorted.

19. A method for deidentifying entries in an input data source, comprising:

receiving a specified anonymity requirement; and

modifying entries in a version of the input data source to yield an output data source such that the entries of the output data source match the specified anonymity requirement.

28. A system for deidentifying entries in an input data source, comprising:

means for modifying entries in a version of the input data source to yield an output data source such that the entries of the output data source match a specified anonymity requirement.